NOPFIT: File System Integrity Tool for Virtual Machine Using Multi-byte NOP Injection

Abstract

File system integrity is very important to a system security, because it affects all users that share system files. Therefore, file system integrity tool (FIT) is widely used for host based file system monitoring. Recently, virtualization technology is applied to several computing areas such as server virtualization and cloud computing, and increasingly demands for a FIT. However, previous virtual machine FITs are not suitable for virtual machines, because its structure is insufficient to real-time file system monitoring. In this paper, we design and implement a NOPFIT: a FIT using a multi-byte NOP injection on lguest virtual machine. The multi-byte NOP is new debugging technique using undefined opcode exception. Our experimental results demonstrate that the NOPFIT has very low performance overhead. The results indicate that the NOPFIT is appropriate for real-time file system monitoring.